diff --git a/.github/workflows/binaries-mac-arm64.yml b/.github/workflows/binaries-mac-arm64.yml
index 9158bc1bd..8a7d43a3b 100644
--- a/.github/workflows/binaries-mac-arm64.yml
+++ b/.github/workflows/binaries-mac-arm64.yml
@@ -167,6 +167,7 @@ jobs:
     # upload-artifact loses execute permissions, so we tar the binaries to preserve them.
     # github UI always zips artifacts when they are downloaded, so we don't bother compressing the tar.
     # Unfortunately it means users must both unzip and untar.
+    # https://github.com/actions/upload-artifact?tab=readme-ov-file#limitations
     - name: Upload binaries artifact
       uses: actions/upload-artifact@v4
       with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 41e22ffb1..12caba75d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -217,51 +217,51 @@ jobs:
     # ACTIONS
     # in modular steps for faster & more focussed failures
 
-    - name: Install old GHC
+    - name: Install GHC
       run: |
         $stack setup --install-ghc
       if: env.do-all
 
 
-    - name: Install hledger-lib deps
+    - name: Build deps of hledger-lib
       run: |
         $stack build --test --bench hledger-lib --only-dependencies
       if: env.do-all
 
-    - name: Build/test hledger-lib
+    - name: Build/test    hledger-lib
       run: |
         $stack install --test --bench hledger-lib --fast --ghc-options=-Werror
       if: env.do-all
 
 
-    - name: Install hledger deps
+    - name: Build deps of hledger
       run: |
         $stack build --test --bench hledger --only-dependencies
       if: env.do-all
 
-    - name: Build/test hledger
+    - name: Build/test    hledger
       run: |
         $stack install --test --bench hledger --fast --ghc-options=-Werror
       if: env.do-all
 
 
-    - name: Install hledger-ui deps
+    - name: Build deps of hledger-ui
       run: |
         $stack build --test --bench hledger-ui --only-dependencies
       if: env.do-all
 
-    - name: Build/test hledger-ui
+    - name: Build/test    hledger-ui
       run: |
         $stack install --test --bench hledger-ui --fast --ghc-options=-Werror
       if: env.do-all
 
 
-    - name: Install hledger-web deps
+    - name: Build deps of hledger-web
       run: |
         $stack build --test --bench hledger-web --only-dependencies
       if: env.do-all
 
-    - name: Build/test hledger-web
+    - name: Build/test    hledger-web
       run: |
         $stack install --test --bench hledger-web --fast --ghc-options=-Werror
       if: env.do-all
diff --git a/.github/workflows/oldest.yml b/.github/workflows/oldest.yml
index ce2d4b39c..6ddb94eb7 100644
--- a/.github/workflows/oldest.yml
+++ b/.github/workflows/oldest.yml
@@ -97,43 +97,43 @@ jobs:
     # ACTIONS
     # in modular steps for faster & more focussed failures
 
-    - name: Install old GHC
+    - name: Install GHC
       run: |
         $stack setup --install-ghc
 
 
-    - name: Install hledger-lib deps
+    - name: Build deps of hledger-lib
       run: |
         $stack build --test --bench hledger-lib --only-dependencies
 
-    - name: Build/test hledger-lib
+    - name: Build/test    hledger-lib
       run: |
         $stack install --test --bench hledger-lib --fast --ghc-options=-Werror
 
 
-    - name: Install hledger deps
+    - name: Build deps of hledger
       run: |
         $stack build --test --bench hledger --only-dependencies
 
-    - name: Build/test hledger
+    - name: Build/test    hledger
       run: |
         $stack install --test --bench hledger --fast --ghc-options=-Werror
 
 
-    - name: Install hledger-ui deps
+    - name: Build deps of hledger-ui
       run: |
         $stack build --test --bench hledger-ui --only-dependencies
 
-    - name: Build/test hledger-ui
+    - name: Build/test    hledger-ui
       run: |
         $stack install --test --bench hledger-ui --fast --ghc-options=-Werror
 
 
-    - name: Install hledger-web deps
+    - name: Build deps of hledger-web
       run: |
         $stack build --test --bench hledger-web --only-dependencies
 
-    - name: Build/test hledger-web
+    - name: Build/test    hledger-web
       run: |
         $stack install --test --bench hledger-web --fast --ghc-options=-Werror
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e4af035fc..24209f8fd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,6 +21,7 @@ jobs:
 
     # Get artifact from the latest binaries-linux-x64 run
     - name: Get latest linux binaries artifact
+      # XXX unverified, disallowed
       uses: dawidd6/action-download-artifact@09f2f74827fd3a8607589e5ad7f9398816f540fe  # https://github.com/dawidd6/action-download-artifact v3.1.4
       with:
         # Optional, GitHub token, a Personal Access Token with `public_repo` scope if needed